CVE-2026-32596

CVE-2026-32596 is a high-severity authentication bypass vulnerability (CVSS 7.5) affecting Glances, an open-source system monitoring tool, in versions prior to 4.5.2. When the Glances web server is started with `glances -w`, it defaults to running without authentication, exposing its REST API to any network client. This allows unauthenticated remote attackers to access sensitive system information, including credentials (passwords, API keys, tokens) found in process command-lines. The attack vector is network-based with low complexity, leading to high confidentiality impact. There is no evidence of active exploitation, public exploit code, or inclusion in the CISA KEV catalog, though the vulnerability has received minimal community attention.